Overview

overview

8

Static

static

3

2026-07-31...ar.exe

windows10-2004-x64

8

2026-07-31...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    25s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 23:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_d0c5fe355e23df52da085aa245b3a83e_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 23.4MB
  • Sample260731-26ryrasfng
  • SHA256 5b711ffb3440769aa94887e9bd2ad976a92986c206ac6e2db8d1dd004d45abda
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_d0c5fe355e23df52da085aa245b3a83e_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_d0c5fe355e23df52da085aa245b3a83e_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3032
  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_d0c5fe355e23df52da085aa245b3a83e_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-31_d0c5fe355e23df52da085aa245b3a83e_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1200

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.4MB
        • SHA256 67b7d909f2f5bcf45b948d7e6c0201f21cfe4fc1ecdb1b6efcf5c54956d0f984
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.5MB
        • SHA256 75bb32abb4bd607b41844308ddc355ce9330fcf510f18d2a8f2adf33726a4f9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 47.1MB
        • SHA256 d7de9c98c86a571bbec9a275e82993d93e3d8e708557569110ff1603fe0eef52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 66.5MB
        • SHA256 87f9bd2c78628702b65d1b4404bdf04f6f31605af8f63e6c93a0555c354d5ad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 25.5MB
        • SHA256 1ccb0013b8695905f505485c7bd0e639f09a7ffa040a86e0319f1ccbc6ba93fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 46.8MB
        • SHA256 bba06f090f9ecda5013b517bfaac6a0321f036ea42313198a5a4a982a3da379c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 48.5MB
        • SHA256 d94bf7be5c2129e865c55ab2ce3a2af29c8b5b382b499a1a553cb261279b0821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 50.2MB
        • SHA256 86c438503f8bfec6f31c12c095c6d1bd4e4ac14ecf8561236e2fe55fc69e8ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 49.0MB
        • SHA256 340dfcaf3545c7d098bc5855b5f81bc6a9fa4c3343dcf6a2d7779825b422ffed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 48.4MB
        • SHA256 197d341f32d7d829719d499df34819d306affe418a3a93cbc8ecc82fb18fc1ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 49.8MB
        • SHA256 3312bf867c696eb81103e7e611ab2bd7a92b82dc4ad87e7c5805221095912856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 46.8MB
        • SHA256 bd99c2f3a469996267a9c027530eb01b2f9466056591686a11f684be684d682e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 46.8MB
        • SHA256 687795224ee385416a937f75337245a08d662075b5184e0b7c18318438320e74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 47.0MB
        • SHA256 f023cf2fc05467cbf4a3c71b524d931124276cff7642ba4ebad853832a707fc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 46.8MB
        • SHA256 f2ff3c38e1c2f099b48e8c4d16556547ae300f2bc6c41ec07c8e1f089a81e527
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 46.8MB
        • SHA256 0efcc73c96719525c2c0e4e337e7137dabebac1540aebf303010581792bc4410
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 46.9MB
        • SHA256 fe90c429a95cf1e8983a3f00f3316c4015525ac4353f84afac90c430b4a8ebb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 47.0MB
        • SHA256 246c38b8d596a752bc112b0e965742a03aba8eed1a837539cd0cca1cb7d01c04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 46.8MB
        • SHA256 48f70e6b3595013a6605ba4f9a0ebeaba7b2caa7d1a0e55734247dfdb093ec7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 46.0MB
        • SHA256 d4ecf2fb5b3ece274f1beaf5a57d7584a7ea2ae77aaab5ea79bf75009fee8c3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 45.6MB
        • SHA256 d40930b8a34dba7086bb31c30cc78998be1f2ea555ccd4a2791ca6cfc96ea54e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 45.3MB
        • SHA256 f5eaee36b41b7edb59652cfd7b32c8e300c0e8a3d842f438ce91e1831a5444e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 45.0MB
        • SHA256 8a82e029901ddfe0f54b808cf2e41e89c650d81187cce570a5772c22674549a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 44.9MB
        • SHA256 f8e6fd45eb2aabd15fc5fca252ba543713a714c900a111281bd7022607da86fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 44.7MB
        • SHA256 26f3938979799180ec80502c9c66c490166799ba3499971173ca3388c8fe0207
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 40.6MB
        • SHA256 19f5cc91d03664a25a6b47fb65fa16ff0ca761e180bb86d416cea1c6eff83c8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 44.4MB
        • SHA256 22a16bdcc70486f8f0dd93741d1c76c8f4689944b9936086c49716f9b35a0704
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 44.2MB
        • SHA256 8b2060a93aa87ff236b2789d740ad7ce7cd70451c36b23ae43f26420dbb7ca2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 44.1MB
        • SHA256 c0e68c94091e561a1ca687a45e7f218bc049e09a45d7134166146ed473cacc6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 43.8MB
        • SHA256 f7daef5c24d719baa55e9fdb8bce99d880adcd2b32300592d4c733ac135cf26d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 43.8MB
        • SHA256 198791f1b36d4f55dd68f8f51ef187cf7e5499c56306e3e8558ba09b0df82aca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 43.7MB
        • SHA256 acfd1616123ad5f61f5bdad377bb577fbb37fe7d229023da65d73c7477f9a043
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 43.6MB
        • SHA256 3229a07926a191ff90bf6065109384b7d774a1971007d9609d9867a0584011ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 43.5MB
        • SHA256 95f7820b608e5528061a09bfbfa983fb1b87ee64904170d3ee528442239adddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 43.5MB
        • SHA256 175d9470855ac1735220424ae32031051b7cd8f638f43acb9ce44fd37c8e7d88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 43.4MB
        • SHA256 bcb072c9525b7c208eb3faeb6aeaabdc7fd3623c5dc9e29b0c37d45c32a8bf8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 43.1MB
        • SHA256 a09dd51f11c0464702860d0fa2d77760f9ffc4936eb9d5f1a02ca06425be331f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 43.2MB
        • SHA256 d178a5468c21cd46291f16d2bd4793599c9f82732c03d1f919cc0b7399b879ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 43.1MB
        • SHA256 327a010ae9b39e5538c42240c5aedf203ab19ac995663a3fa07c0a0ef7d2d6b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 42.8MB
        • SHA256 75076aec2444e0563c5d717cf9575d3720221fc0cc68037c416f3ff146f28ecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 42.9MB
        • SHA256 adab5307c10961f4ed4472181a97cbd80ff447a2855b1023188b9bbc9c7aa32f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 46.9MB
        • SHA256 4de212e5370b2249020429c97ab1b7cd1240f0bd24f833171045a33ed51c8e30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 46.8MB
        • SHA256 2c40e36ac51a852bc7c27b84e437638fda6ff62d889837ce2b624f2b540b56e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 46.8MB
        • SHA256 f490bcdbd5530a2ea6366a51e6a1ebce4e507b4b9d3e1c58761d2a6f68bb1f66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download